Method for selecting an executable software image

ABSTRACT

An apparatus and an associated methodology is provided to select and run an image of an executable software, the method including the steps of: starting a self executable boot and load software stored in the apparatus configured to run an executable software image; reading a table stored internally in the apparatus by the self executable boot and load software, referencing an executable software images that are stored in the apparatus; selecting an uncorrupted executable software image from one of the executable software images that are referenced in the table; and starting the image chosen by said selecting.

TECHNICAL FIELD

The invention relates to a process for selection and starting an image,in other words a copy of an executable software, for example to processreception of a digital television program. It is particularly applicablein the field of digital television decoders.

STATE OF THE ART

Existing digital television decoders have resident software that is theimage of an executable software, that is for example executed every timethat the decoder is switched on. This image is used to process programsreceived by the decoder to transform the received digital signal into avideo signal in the broad sense of the term, in other words into asignal containing an image, sounds, synchronization signals, and alsopossibly text and in general a set of information that can betransformed into meaningful signals for a user of a terminal stationcomprising the decoder. The resident software may be stored in a memoryof the decoder. It may also be loaded into this memory from aninformation stream received by the decoder. The resident or loadedsoftware can be executed, or the software can possibly be loaded from areceived digital flow, due to the presence of the boot software andloading software. The boot software and the loading software comprise aninitial set of instructions with a cross reference to a residentsoftware start address. The loading software started by the bootsoftware checks that the resident software is present and isuncorrupted. It contains instructions necessary to load an executablesoftware if necessary, and to start it from the digital data streamreceived by the decoder if returned information signals that there is noimage present in any of the decoder storage means. If it is confirmedthat there is an uncorrupted image present, or after the image has beenloaded from the digital data stream if necessary, the loading softwareloads the resident software into a memory area in which it can beexecuted, and then executes it. The resident software is executed todecode the received programs. The entire resident software including theboot software and the loading software are stored in a memory of thedecoder. The boot and the loading software are stored in a non erasablepart of memory or preferably have erase protection by software. Theresident executable software is stored in an erasable part of memory. Ifthe resident software is loaded from the digital data stream received bythe decoder, the received software will overwrite the software that isalready resident in the erasable memory area, if any, in which the saidsoftware will be stored. The loading software is also used to load a newimage or to update a resident image from the digital data stream.

BRIEF DESCRIPTION OF THE INVENTION

In the current state of the art, only one executable software image isstored. Regardless of whether it was previously loaded from thebroadcast stream or was resident, this software is executed from thememory in which it was loaded to be executed.

According to this invention, it is intended to store several executablesoftware images in the decoder. Therefore, the invention relates to aprocess as described below, starting from the boot and loading softwareprovided with the decoder by the decoder manufacturer, to

-   -   select one of the images of the executable software among the        images of the software stored in the decoder on a decoder        memory,    -   decompress the selected software image if the selected software        image is stored in compressed form,    -   if necessary, load the image of the software selected from the        memory in which it is stored, into a memory from which it can be        executed, for example to load it into a fast memory if the image        of the selected software is initially stored on a hard disk,    -   finally run the image of the selected software.

Obviously, the process according to the invention can be used to load anexecutable from the data stream, in the same way as in prior art, ifthere is no image of the executable software available in a memory ofthe decoder of if the available image is corrupted or if it is asuperseded version that needs to be replaced.

In summary, the invention relates to a process that can be used in adigital television reception set, for example in a digital televisionreception decoder to select and run an image of an executable software,the process including starting a self executable boot software to run animage, the process being characterized in that the boot software and theloading software include the following steps:

-   -   c) read a table internal to the reception set, referencing an        integer number n greater than 1 of executable software images,        in a predetermined order,    -   s) selecting an uncorrupted image of the executable software,    -   l) starting the selected image for execution.

Preferably, a step v1) is carried out before step c) to check that theboot software table is present and is uncorrupted.

In general, before the process according to the invention is executed,the references table containing an integer number n of references willhave been created, each reference in the table containing a univocalcross reference to one of n images stored in a memory area, the selfexecutable boot software containing a cross reference to the said bootsoftware table, and then according to a routine carried out every timethat the decoder is switched on or reinitialized:

-   -   v1) it is checked that the boot software table is present and is        uncorrupted,    -   p) the table is read in a predetermined order to reach the        references of the table in the order of preference of the stored        images corresponding to each reference in the table,    -   v2) it is checked that the image corresponding to the first        reference in the table reached by reading the table is        uncorrupted,    -   l) if the image checked in step v2) is uncorrupted, the said        image may be loaded and execution of this image is started,    -   e) if the image is corrupted, then the next current reference in        the table after the previous reference is selected in the        predetermined read order, and step v2) (and possibly step l) if        the current image is uncorrupted) are carried out, and if it is        corrupted, step e) is started again for the next reference in        the order of reading the table until an uncorrupted image is        found.

Preferably, the n images are distributed in two parts, a first partcomposed of an integer number (n−m) of images stored in erasable partsof memory and a second part complementary to the first part composed ofan integer number of images m less than or equal to n stored in parts ofnon erasable memory or areas with erase protection.

In this case, in preference the select reference step s) and the checkintegrity step v2) are carried out firstly for the (n−m) imagescontained in memory areas without erase protection, then if none ofthese images is uncorrupted, for the m images contained in the memoryareas that are non erasable or with erase protection.

Preferably, the m images stored in the memory areas that are nonerasable or with erase protection are stored on different media, suchthat there is not more than one image with erase protection on eachmedium, for example an image on the hard disk and an image on a fastmemory.

If the table is corrupted, or if none of the images found by reading theentire table and making the check v2) firstly of the (n−m) images storedin a memory area without erase protection are uncorrupted, then theselection step a) and the check step v2) are repeated, and possibly theloading step and then the run step l) are also repeated, for the mimages stored in the memory area with erase protection, these m imagesbeing read in a predetermined order corresponding to an order ofpreference.

In the step prior to execution of the process to create the referencetable, an integer number n of images is loaded into the decoder,preferably distributing them into (n−m) images stored in memory areaswithout erase protection and m images stored in memory areas with eraseprotection, with one image per storage medium.

According to one embodiment, the memory areas with erase protection inwhich the m images are stored are memory areas on a hard disk.

According to one embodiment, before one of the images is loaded forexecution, it is checked that this image is not stored in a compressedmode, and if it is the image is decompressed before being loaded andexecuted.

BRIEF DESCRIPTION OF THE DRAWINGS

An embodiment of the invention will now be explained with reference tothe attached drawings in which:

FIG. 1 is a diagrammatic view of a fast memory and its contents relativeto the executable resident software according to prior art,

FIG. 2 shows a fast memory and a storage memory and the contents of eachaccording to an embodiment of this invention,

FIG. 3 is a diagrammatic view showing information storage means for adecoder incorporating the invention,

FIG. 4 is a flow chart showing the steps in the process according to theinvention to select and then possibly load and run one of the executablesoftware images loaded in one of the decoder storage means.

DESCRIPTION OF AN EMBODIMENT

An embodiment of this invention will now be described with reference tothe attached drawings.

Firstly, the state of prior art will be summarized with reference toFIG. 1.

A first part 1 that is non erasable or with erase protection located ina fast memory 10 of a decoder, for example a “flash” type memory asloaded according to prior art, contains a boot software and a loadingsoftware. This boot software and this loading software are known and areloaded by the decoder manufacturer.

Part 2 of the memory contains other information that is not concerned bythis invention.

An erasable part or a part without erase protection 3 in memory 10contains a resident image of an executable software.

Operation is as follows. The boot software is self executed when thedecoder changes from an off state to a standby or on state, or followinga reinitialization. Thus, for example when the decoder is started, theboot software outputs an instruction to run the loading software. Thisloading software checks that the executable software image stored inpart 3 of the decoder memory is present and is uncorrupted. The softwaremeans to check this integrity are known in themselves. For example, itcould be a checksum or a longitudinal redundancy code (LRC) check.

If the result of the check shows that there is a software image loadedin 3 and that this image loaded in 3 is uncorrupted, then the bootsoftware starts execution of the said executable software stored in 3 ofthe decoder memory. If the result of the check indicates that there isno software in 3 or that the software loaded in 3 is corrupted, then theboot software and the loading software start loading an image of anexecutable software from the data stream. The image loaded from the datastream then overwrites the corrupted image in 3.

The difference between one embodiment of the invention and the state ofthe art is that this embodiment includes several executable softwareimages stored on different storage means in the decoder, for example afast memory, a hard disk with a non-erasable part and an erasable part,these examples being not restrictive. Each of the executable images maybe booted. The result is that the boot software contains a crossreference to a reference table 16 represented symbolically in FIG. 2.The table 16 contains one reference for each executable software imagein the decoder. FIG. 2 shows the case in which n=5 and m=2. In thisexample, there are four executable software images in addition to thesingle image included in prior art. For example, the result may be animage in a memory area with erase protection on a hard disk, an image onan area with erase protection of a fast memory, and three images inareas without erase protection on the hard disk or a fast memory. Thereferences or addresses of cross references to the first instruction foreach of these images are stored in areas 11, 12, 13, 14 and 15 formingpart of an area 4 of the memory, for example the fast memory 10. Thus,for example, areas 11-13 may contain cross references to memory areas onthe hard disk without erase protection and areas 14 and 15 may containcross references to addresses of non erasable memory areas or areas witherase protection on a hard disk or a fast memory. From the descriptionpoint of view, reference 4 denotes the hardware support of table 16.Reference 16 denotes the information content in memory area 4. As inprior art, the area 1 of fast memory 10 contains the boot software andthe loading software normally supplied with the decoder. According tothis invention, the fast memory 10 has a memory area 1′ containing animage selection and loading software to form the process according tothe invention.

An example of a hardware system designed to form the hardware support ofthis invention is shown in FIG. 3.

A fast memory (flash) 10, a random access memory 30, and a hard diskforming part of a decoder or connected locally to this decoder such thatit can be considered that these means are internal to the decoder, areconnected to each other and to a system unit 40 through a bus 50. Thehard disk 20 contains an area 21 with erase protection and an area 22without erase protection. The area 22 without erase protection containsa first, a second and a third image of the executable software in areas25, 26 and 27 of area 22 respectively. An area 28 not used for thisinvention contains other data or an empty part. The area 21 with eraseprotection has an area 23 containing a fourth image of an executablesoftware. An area 24 of the area 21 not used for this invention containsother data or an empty part. When one of the four software images storedhas been selected by the loading and start software stored in area 1′,and if it cannot be executed directly from its support, this image isloaded for example into a part 31 of the random access memory 30.

The image selection and loading software stored in area 1′ will now bedescribed with reference to FIG. 4.

Firstly, note that the executable selection and loading software iscalled by the boot software stored in area 1, to be loaded for exampleinto RAM memory if necessary for execution, and is executed. In the casedescribed with relation to FIG. 2 in which area 1 is a fast memory area,the loading and selection software can be executed directly from itssupport.

The decoder manufacturer designs and loads this boot software into thedecoder. The described software architecture in which a cross referenceis made to the software loaded in area 1′ is adopted to satisfy the needto adapt to decoders as they exist at the moment. It is obvious that thesoftware architecture could be different for decoders designed to beadapted to the invention, the essential point being that the functionsthat will be described are included.

The process according to the invention is initiated after the bootsoftware delivered with the decoder has called the software located inarea 1′ to select and possibly to load an executable according to thisinvention. Thus, according to a first modification from prior art, theinstruction address specified by the boot software to check the presenceand integrity of the resident software no longer corresponds to thisfirst instruction, but rather to a cross reference instruction to thesoftware according to the invention.

According to a first step v1) shown in 101, it is checked that the table16′ is uncorrupted and contains at least one address for an executablesoftware image, and that it is a reliable address.

If this is not the case, the next step 102 is performed in which it ischecked that the executable software image stored in the area 23 of thehard disk 20 with erase protection is present and is uncorrupted.

If the check carried out in step 102 shows that the image of theexecutable software stored in the area 23 of the hard disk 20 with eraseprotection is present and is uncorrupted, then this image may be loadedin a step 103, for example into the random access memory 30, in area 31to be started in execution in a step 104.

If the check carried out in step 102 confirms that the executablesoftware image stored in the area 23 on the hard disk 20 with eraseprotection is not present or is corrupted, then the next step 105 iscarried out in which it is checked that the executable software imagestored in 3 of fast memory 10 with erase protection is present and isnot corrupted. If the check is positive, steps 103 and 104 are executed.

In general, if the table 16 is corrupted or if none of the imagesselected by the table is uncorrupted, then the m images stored in theareas with erase protection are read in a predetermined order to selectand load the first of these images that is found to be uncorrupted.

If the check v1 carried out in step 101 is positive, in other words ifthe table 16 is uncorrupted and contains a first address for an image ofan executable software, step v2 106 is carried out in which it ischecked that the first image of the executable software stored in area25 of hard disk 20 without erase protection is present and isuncorrupted. If this check is positive, then the next steps 103 and then104 are carried out.

If the check carried out in step 106 is negative, the next image of thetable 16 is selected in a step 107. The same check that was carried outin step 106 is carried out in step 108 for the second image of theexecutable software stored in the area 26 of the hard disk 20 withouterase protection. If this check is positive, then steps 103 and then 104are carried out.

If the check carried out in step 108 is negative, then step 107 isrepeated in which the same check is carried out for the third executablesoftware image stored in the area 27 of the hard disk 20 without eraseprotection. Steps 107 and 108 are started again for each image until anuncorrupted image is found. When a positive check is carried out in step108, step 103 and then step 104 are carried out such that the thirdimage, or in general the first uncorrupted image found in apredetermined order of reading the table 16 is executed.

In general, if table 16 is uncorrupted, then the table is read to selectthe first uncorrupted image referenced by the table.

The process that has just been described is used to select, and possiblyload if necessary and then run the preferred image among the executablesoftware images available in the decoder, with preference given firstlyto the images stored in areas 25-27 of the hard disk 20 without eraseprotection and then the images in areas 23, 3 of the hard disk 20 witherase protection, or the fast memory 10 respectively. In the examplecommented in relation with FIGS. 2-4, the preferred images are thefirst, second, and third images and possibly other images if they exist,in a predetermined order of preference starting firstly with imagesstored in areas of the hard disk 20 without erase protection, and thenimages stored in areas of the hard disk 20 with erase protection, andthen in the fast memory 10.

If no executable software image is uncorrupted, then as in prior art aloop not shown in FIG. 4 is executed, consisting of returning to theboot software which in a known manner starts loading an executablesoftware from the digital data stream received by the decoder.

Optionally, if it is intended to store or load images from the stream ofimages in compressed form, then a step 109 to check the state ofcompression of the selected image is carried out before step 103 ofloading the selected image in RAM. If the image is not compressed, thenstep 103 is carried out directly. If the image is compressed, forexample using a ZIP code, then step 103 is carried out through adecompression step 110. The table attached to this description containsthe text that appears in each of the boxes in the flow chart shown inFIG. 4.

APPENDIX

101 102 Is there an address of an Is the software image in theexecutable software image in area of the hard disk with the bootsoftware table or protection uncorrupted? is the boot software tableitself uncorrupted? 103 104 Load the selected executable Run theselected executable software image into RAM software image memory ifnecessary 105 106 Is the executable software Is the first uncorrupted inthe area of fast memory software image on the hard with protectionuncorrupted? disk uncorrupted? 107 108 Select the next image in the Isthe next executable table software image uncorrupted? 109 110 Is theselected image Decompress the selected compressed? image

1. A method of selecting and running an executable software image in anapparatus, the method comprising: starting a self executable boot andload software stored in the apparatus configured to boot an executablesoftware image; reading, by the self executable boot and load software,a table stored internally in the apparatus, the table referencing aninteger number n greater than 1 of executable software images, the nexecutable software images being pre-stored in the apparatus in apredetermined order, each of the executable software images beingindependently bootable, the n images being distributed over two parts ofthe memory, a first number (n−m) of images being stored in an erasablepart of a memory and a second, complementary number m of images, m beingan integer number less than or equal to n, being stored in a part of thememory not erasable or having erase protection; checking whether thetable is present and uncorrupted before said reading; selecting oneuncorrupted executable software image from the executable softwareimages that are referenced in the table; and booting the one executablesoftware image chosen by said selecting, wherein the n executablesoftware images are not downloaded to the apparatus in a current bootprocess.
 2. The method according to claim 1, wherein the reading and theselecting further comprise: reading the table following a predeterminedorder to read references of the table in an order of preference of theexecutable software images to which each reference corresponds,integrity checking that a first selected image corresponding to thefirst reference in the table reached by reading the table isuncorrupted, the first image only being selected when the integritycheck of the first image is positive; and reading a next referencefollowing the previous reference in the table in the predetermined readorder when the first image or a previously checked image is corrupted,and reexecuting at least one of the selecting and starting operationswhen the current checked image is uncorrupted, and when the currentchecked image is corrupted then repeating the operation for the nextreference in the order of reading the table, until an uncorrupted imageis found and run.
 3. The method according to claim 1, wherein thereferences in the table corresponding to the (n−m) images contained inthe memory areas without erase protection are read first, and then ifnone of these images is selected, reading continues for the m imagescontained in the memory areas that are not erasable or that have eraseprotection.
 4. The method according to claim 1, wherein when checkingshows that the table is corrupted, at least one of the integritychecking and storing operations are carried out for the m imagescontained in the memory areas that are not erasable or that have eraseprotection.
 5. The method according to claim 1, wherein the m imagesstored in the memory areas that are not erasable or with eraseprotection are stored on different media.
 6. The method according toclaim 1, wherein the memory areas without erase protection in which the(n−m) images belonging to the first part are stored, are memory areas ona hard disk.
 7. The method according to claim 1, wherein the memoryareas with erase protection in which the m images belonging to thesecond part are memory areas on a hard disk or a fast memory.
 8. Themethod according to claim 1, before one of the images is run forexecution, a check is made that this image is not stored in compressedmode, the image being decompressed before being loaded and executed ifit is found to be compressed.
 9. The method according to claim 1,wherein an integer number n of images is loaded prior to execution ofthe process, and distributed in a first part containing (n−m) imagesstored in memory areas without erase protection and a second partcontaining m images stored in memory areas with erase protection, and inthat the reference table is created for the n images.
 10. A digitaltelevision decoder or receiver comprising a processor and a storageunit, the processor configured to: start a self executable boot and loadsoftware stored in the storage unit of the decoder or receiver, the selfexecutable boot and load software being configured to boot an executablesoftware image; read, by the self executable boot and load software, atable that is stored internally in the decoder or receiver, the tablereferencing an integer number n greater than 1 of executable softwareimages, the n executable software images being pre-stored in the storageunit in a predetermined order, each of the executable software imagesbeing independently bootable, the n images being distributed over twoparts of the memory, a first number (n−m) of images being stored in anerasable part of a memory and a second, complementary number m ofimages, m being an integer number less than or equal to n, being storedin a part of the memory not erasable or having erase protection;checking whether the table is present and uncorrupted before saidreading; select an one uncorrupted executable software image from theexecutable software images that are referenced in the table; and bootthe one executable software image chosen by said selecting, wherein then executable software images are not downloaded to the decoder orreceiver in a current boot process.
 11. The method according to claim 1,further comprising: checking whether the one executable software imagechosen from the executable software images that are referenced in thetable is corrupted or not, after said selecting.
 12. The methodaccording to claim 11, further comprising: selecting another executablesoftware image that is referenced in said table, when the one executablesoftware is determined to be corrupted in said checking.
 13. The methodaccording to claim 1, further comprising the steps of: a first checkingwhether the table is corrupted or not; a second checking whether the oneexecutable software image selected from the n executable software imagesreferenced in the table is corrupted or not, after said first checkinghas confirmed that the table is not corrupted; copying the one selectedexecutable software image to a random access memory; and a thirdchecking whether the one selected executable software image in therandom access memory is corrupted or not.
 14. The digital televisiondecoder or receiver according to claim 10, wherein the processorconfigured to: perform a first check to see whether the table iscorrupted or not; perform a second check to see whether the oneexecutable software image selected from the n executable software imagesreferenced in the table is corrupted or not, after said first check hasconfirmed that the table is not corrupted; copy the selected oneexecutable software image to a random access memory; and perform a thirdcheck to see whether the selected one executable software image in therandom access memory is corrupted or not.
 15. The digital televisiondecoder or receiver according to claim 14, wherein the selected oneexecutable software image processes digital information received by thedecoder or receiver into images, sounds and synchronization information.